How many misses and over what time lead to a ban is set by three parameters, and a fourth keeps your own addresses out of bans.
maxretry — how many refusals before a ban; findtime — the window they are counted in (refusals older than the window are forgotten); bantime — how long the address stays banned. ignoreip is a list of networks and addresses the jail skips even if refusals come from them: admins' workstations go there, so as not to cut yourself off from the server. All these parameters go into your own jail.local file — it survives a package update; the package jail.conf is left alone. fail2ban also reads the jail.d/ directory: its *.conf files before jail.local, its *.local files after, and the last value wins (file order). sudo fail2ban-client -d prints the result for a jail.
The jail has maxretry = 3, findtime = 10m. What leads to a ban?
-
findtimeis a window: refusals from the last ten minutes count, older ones are forgotten. Three old misses will not cause a ban. -
The threshold is
maxretry(3), and the window isfindtime(10m). Here the numbers are swapped.
maxretry is the refusal threshold, findtime the window they are counted in. Three refusals in ten minutes reach the threshold and trigger a ban; misses older than the window are forgotten.
Key points
-
maxretryis the refusal threshold,findtimethe window they are counted in,bantimethe ban duration. -
ignoreipexcludes your own networks and addresses from bans. -
Your own settings go in
jail.local;jail.d/*.localfiles are read after it and override its values.